Skip to content

Commit ff1c451

Browse files
test: restore url in finally block after open redirect test
1 parent 8a23d7e commit ff1c451

1 file changed

Lines changed: 22 additions & 19 deletions

File tree

__tests__/with-authentication-required.test.tsx

Lines changed: 22 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -186,27 +186,30 @@ describe('withAuthenticationRequired', () => {
186186
// Simulate a URL like https://app.example.com//evil.com whose pathname is //evil.com.
187187
// Routers (react-router, next.js, gatsby) treat //evil.com as a protocol-relative URL
188188
// and redirect the user to http://evil.com.
189+
const originalUrl = window.location.href;
189190
window.history.replaceState({}, '', 'https://www.example.com//evil.com');
190191

191-
mockClient.getUser.mockResolvedValue(undefined);
192-
const MyComponent = () => <>Private</>;
193-
const WrappedComponent = withAuthenticationRequired(MyComponent);
194-
render(
195-
<Auth0Provider clientId="__test_client_id__" domain="__test_domain__">
196-
<WrappedComponent />
197-
</Auth0Provider>
198-
);
199-
await waitFor(() =>
200-
expect(mockClient.loginWithRedirect).toHaveBeenCalledWith(
201-
expect.objectContaining({
202-
appState: expect.objectContaining({
203-
returnTo: '/evil.com',
204-
}),
205-
})
206-
)
207-
);
208-
209-
window.history.replaceState({}, '', 'https://www.example.com/');
192+
try {
193+
mockClient.getUser.mockResolvedValue(undefined);
194+
const MyComponent = () => <>Private</>;
195+
const WrappedComponent = withAuthenticationRequired(MyComponent);
196+
render(
197+
<Auth0Provider clientId="__test_client_id__" domain="__test_domain__">
198+
<WrappedComponent />
199+
</Auth0Provider>
200+
);
201+
await waitFor(() =>
202+
expect(mockClient.loginWithRedirect).toHaveBeenCalledWith(
203+
expect.objectContaining({
204+
appState: expect.objectContaining({
205+
returnTo: '/evil.com',
206+
}),
207+
})
208+
)
209+
);
210+
} finally {
211+
window.history.replaceState({}, '', originalUrl);
212+
}
210213
});
211214

212215
it('should call loginWithRedirect only once even if parent state changes', async () => {

0 commit comments

Comments
 (0)